The UK's DMCC Act is Here: A Buyer's Guide to Navigating the New E-Commerce Rules

The short version stated plainly: The UK's Digital Markets, Competition and Consumers (DMCC) Act has fundamentally outlawed the two most common growth hacks in e-commerce—drip pricing and fake reviews. As of mid-2025, the Competition and Markets Authority (CMA) has the power to bypass courts and directly fine companies up to 10% of their global turnover for violations. The era of move fast and hide the booking fee is officially over, evidenced by the CMA's £4.2 million fine levied against AA Driving School in April 2026 for obscuring a mandatory £3 charge. Now, every digital storefront operating in the UK must restructure its checkout flow and review architecture to survive the new regulatory regime.[1][2][7]

The legislation distinguishes between what is merely annoying and what is now strictly illegal. Drip pricing—the practice of advertising a low headline price and adding mandatory taxes, service fees, or delivery charges at the final checkout screen—is now banned outright. The total price must be displayed at the first invitation to treat, meaning the moment a consumer sees a product listing. Similarly, hosting, commissioning, or failing to take reasonable steps to remove fake reviews is now a strict liability offense. The CMA no longer needs to prove that a fake review actually harmed a specific consumer; the mere presence of deceptive choice architecture is enough to trigger an investigation and subsequent financial penalties.[3][6]

For technology buyers and e-commerce directors, this regulatory shift has spawned a cottage industry of compliance vendors promising instant DMCC compliance via artificial intelligence. The marketing language is aggressive, but a skeptical look at the actual capabilities reveals a significant gap between what is announced in press releases and what has actually shipped in the software. Artificial intelligence cannot magically determine if a user actually stayed at a hotel or purchased a sweater; it can only flag anomalous text patterns or unusual posting frequencies. Relying entirely on algorithmic sentiment analysis to satisfy a legal requirement is a gamble that many corporate counsels are advising against.[5][8]

The drip pricing mandate is primarily a data engineering challenge rather than a behavioral one. Legacy e-commerce platforms often calculate tax and shipping dynamically based on the user's final address input at the end of the funnel. Complying with the DMCC requires moving those API calls to the top of the funnel, which can increase page load latency and requires sophisticated geolocation caching. It is a hard technical problem, but a solvable one. Companies must audit their choice architecture to ensure that checkout processes and customer interfaces support timely price presentation, even for elements that are difficult to calculate in advance.[3][6][8]

Review management, however, presents a much thornier behavioral and cryptographic problem. The law requires platforms to take proportionate steps to ensure reviews reflect a genuine consumer experience. This has forced a reckoning among platforms that previously relied on open review submissions to pad their search engine optimization (SEO) rankings and user-generated content metrics. The new monitoring obligations mean that turning a blind eye to suspicious review velocity is no longer a viable growth strategy. Businesses must now implement clear, accessible policies to detect and remove fake reviews, and they must continuously evaluate the effectiveness of those policies.[1][4][8]

Software vendors are currently pushing three distinct architectures to solve the review liability problem. The first is the Verified-Purchaser Closed Loop, which ties every single review to a cryptographic transaction ID. The second is the AI-Moderated Open Platform, which uses machine learning to filter out bot farms and paid review rings while still allowing unverified users to post. The third is the Outsourced Trust Aggregator, where companies offload the liability entirely to third-party verification platforms. Each approach carries distinct trade-offs between legal safety, marketing velocity, and engineering overhead.[2][5][8]

When evaluating these solutions, buyers must strip away the vendor hype. A software provider claiming their AI has a 99% accuracy rate in detecting fake reviews is usually measuring its success against known, low-effort spam, not sophisticated, human-written commissioned reviews generated by paid rings. The CMA's informal guidance explicitly states that relying solely on automated filters may not meet the threshold for reasonable steps if the underlying data lacks purchase verification. The regulator expects regular risk assessments and proactive measures, not just a set-and-forget software installation.[4][5][8]

Ultimately, the DMCC Act forces a stark trade-off between review volume and legal liability. As the CMA ramps up its enforcement actions throughout 2026—moving from its initial grace period into active penalization—e-commerce operators must choose an architecture that aligns with their risk tolerance and margin structure. The following comparison breaks down the three dominant strategies for review management, quantifying the trade-offs and identifying where each approach actually fits in a post-DMCC landscape. There is no single winner; the right choice depends entirely on what a brand is selling and how much risk it is willing to absorb.[5][8]